PT-2022-7676 · Linux+4 · Linux Kernel+4
Syzbot
·
Published
2022-11-29
·
Updated
2026-03-14
·
CVE-2022-48950
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the
perf pending task() function in the Linux kernel, which can lead to a use-after-free condition. This occurs when perf pending task() runs after the event is freed. There are two distinct cases: the task work was already queued before destroying the event, and destroying the event itself queues the task work. The first case cannot be solved using task work cancel() because perf release() might be called from a task work, making the current task work list empty. The simplest alternative is to extend the perf event lifetime to cover the task work. The second case can be avoided by rearranging how the event is marked as STATE DEAD and ensuring it goes through STATE OFF on the way down.Recommendations
As a temporary workaround, consider extending the
perf event lifetime to cover the task work.
Restrict access to the perf pending task() function to minimize the risk of exploitation.
Avoid queueing a task work while the event is being destroyed.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Linux Kernel
Red Hat
Red Os